Policy-settings environment stripping is case-insensitive

Environment variables your org policy blocks can no longer sneak through by changing their capitalization.

You'll noticeTier: how much it should matter to you

3Useful: my rating, 1 to 5

0Signal: worth watching, 1 to 5

PermissionsArea: what it touches

ImprovementsKind: in v2.1.223, 05 Aug 26

ImprovementsSection of the release

What

Environment variables that policy settings are meant to strip can no longer be smuggled through by changing their case.

Details

the ANTHROPIC_UNIX_SOCKET-related stripping moved from destructuring fixed key names to an uppercase set lookup, and NO_COLOR/FORCE_COLOR handling did the same
per-helper env allowlists were introduced for apiKeyHelper, awsAuthRefresh, awsCredentialExport and gcpAuthRefresh, plus a list of OTel logging variables

Evidence

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Read from

The build it came inv2.1.223

5 Aug 2026 · 201 entries, this one is #71.

Either side of it

Open the release →

Names in this entry

envANTHROPIC_UNIX_SOCKET
Environment variables your org policy blocks can no longer sneak through by changing their capitalization.
envNO_COLOR
Small polish: credit labels, an extra help link, bigger artifact fetch limit, safer MCP environment handling.
envFORCE_COLOR
Small polish: credit labels, an extra help link, bigger artifact fetch limit, safer MCP environment handling.
settingapiKeyHelper
Generate the API credential with your own command
settingawsAuthRefresh
Refresh expired Bedrock credentials in .aws with your own command
settingawsCredentialExport
Supply Bedrock credentials as JSON from your own command
settinggcpAuthRefresh
Refresh Google Cloud credentials with your own command
envANTHROPIC_BEDROCK_MANTLE_BASE_URL
Override the Amazon Bedrock Mantle endpoint URL. See Mantle endpoint

Is this right?

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.